Michael Lynton on Surviving the Biggest Corporate Hack in History

ADI IGNATIUS: Welcome to the HBR IdeaCast from Harvard Business Review. I’m Adi Ignatius, editor-in-chief. And I met recently with the CEO of Sony Pictures Entertainment, Michael Lynton. We discussed how Sony survived the biggest corporate hack in history and what Michael learned from the process. Here are excerpts from our conversation.

So let’s talk about that for a second. Is your assumption that this was North Korea or North Koreans or–

MICHAEL LYNTON: I don’t make that assumption. I don’t make any assumption. I was actually oddly not concerned by who did this. I was more concerned about how to get the business up and running, and more concerned about making sure that the folks here felt calm enough and felt secure enough to keep on going with their jobs.

What the government’s told me, what the FBI has told me, what the president of the United States has said, is that it’s North Korea. I have to believe them. They did the forensics on it. They did the intelligence works on it. They’ve come back and said publicly that this is who they think are the guilty party.

ADI IGNATIUS: I mean, there’s a lively hacker community discussion that thinks that’s not true, for reasons, including the fact that some of the early communications when the hacker had nothing to do with the interview.

MICHAEL LYNTON: Correct. I see that. What I also do know, though, from some experts who have told me, is that what was done– the level of destruction and the level of sophistication as to what was done was very, very expensive, and would’ve required a lot of people to have done it. So I don’t know who is capable of doing that. I don’t know whether it’s the North Koreans or another entity, but it wasn’t, in my mind, some disgruntled employee. It was way too sophisticated for that to have been the case.

ADI IGNATIUS: So do you or does the company have any regrets about the specifics of the interview; that it identified Kim Jong-un, that it identified North Korea, as opposed–

MICHAEL LYNTON: No. I answered that in the CNN interview. We made that decision a while ago, and that’s not a regret, per se. And certainly, once you make the decision to go forward with making the movie, and you’re under an obligation to yourself and the creative community to make sure that it gets put out, we stayed true to that. So I have no regrets in putting it out, either.

So the issue that we were dealing with during the hack was a– let me put it this way. When we were in the middle of the hack, or, rather, in those five to six crucial weeks when we were trying to get the business up and running and making sure that people were calm and collected– and that’s a whole other issue, and the FBI behaved brilliantly during that– regret never entered into the equation. What was the primary focus was, let’s make sure that we can keep going. Let’s make sure we get the movie out, and make sure that we can keep our business up and running. And that– thanks to the people here– we were successful at.

ADI IGNATIUS: Yeah. So some of the emails that– and, of course, I’ve read the reports of them– where certain things were said about Hollywood stars, whatever, how do you get through that? I mean, I assume in this business you’re dealing with some of the biggest egos in the world, but did people shrug it off, or are you having to mend relationships?

MICHAEL LYNTON: It’s interesting that you ask me. I think, for the most part, people shrug it off. I mean, I know that a number of people whose emails said those kinds of things about certain individuals, picked up the phone and apologized, or had a face-to-face conversation with people. And I think, frankly, the Hollywood community, while a close community, is also a transactional community. And I think people want to make movies and television shows. And I think that, frankly, a lot can be forgiven in that process. I haven’t seen that to be an impediment to us.

ADI IGNATIUS: So, in terms of these things being public and being cataloged and all that, I think Julian Assange’s argument is, roughly, well, this is a big public company, so these deserve to be publicly accessible. I’m assuming you don’t agree with that.

MICHAEL LYNTON: Well, I don’t agree with that, for starters. I also don’t agree with it because there’s a lot of personal information there, which is also now available, and I do think people have a right to their privacy. Listen, I didn’t agree with a lot of the way that the press was treating looking through the emails in the first place. So leaving aside for a moment that they were fully indexed.

ADI IGNATIUS: Yeah. Were you surprised– miffed– by the lack of solidarity from your sort of colleague competitors who maybe could’ve rallied around, you know, we’re all Sony now, after the hack?

MICHAEL LYNTON: I was a little bit, in the moment. I’ve since sort of come to understand it better. So you always think about the previous experience. I had come to Penguin years after the Salman Rushdie thing, but I know what happened under Rushdie and that we were still experiencing a lot of the aftermath of it even when I got there. And in that instance– and it was pre-9/11– admittedly, the publishers did stand behind Penguin, and the bookstores stood behind Penguin, as well, if you’ll remember. Walden and B. Dalton, and all the bookstores in the UK. And in that instance, also, three people died– two translators and a bookstore owner.

Here, I think, in retrospect, the problem was that our competitors and my colleagues were worried about themselves getting hacked and worried about shareholder lawsuits if they came forward in support of us. And I can see that that was a general concern on their part. Some folks have come forward since, very publicly, and said that they should have done more. And the only benefit to them coming forward, frankly, was the fact that the employees here felt quite isolated. You wanted to have the feeling like, OK, fine, we’ve got this problem here, but the industry has all got our back. And between the press and the trades, and for the reasons that I’ve just described, some of my colleagues, having to remain silent on the subject, it felt a little bit isolated at the time.

ADI IGNATIUS: As a civilian– I mean, it bothered me a little bit that this movie– the interview that was sort of the poster child, as you say, for the First Amendment– it wasn’t better?

MICHAEL LYNTON: Right.

ADI IGNATIUS: I mean, I know that’s a matter of taste. I love comedies. I love Seth Rogen movies. I had trouble with that sort of being elevated to the status when it wasn’t Rushdie.

MICHAEL LYNTON: Well, have you read “Satanic Verses”? That’s not “Midnight’s Children.” I mean, it’s not his greatest book. And I dare say the cartoons in Paris were works of art. So the issue isn’t what you’re defending; it’s your obligation to defend it. And oftentimes you find yourself in a situation, I think, when you’re involved in a content company where you’re having to defend the right to distribute or publish something, you’re not necessarily defending the thing itself. That’s not what the First Amendment calls for. So you can say what you want about the interview, whether it was a good movie, a bad movie. I think it probably got a lot more scrutiny than it otherwise would have, if we had just put it out at Christmas and it was sort of an R-rated comedy and Seth doing his thing.

But, to me, that’s not the issue. Yes, you wish it were– I don’t know– some great, great thing, but in no instance that I just described of the three cases were you dealing with great works of art.

ADI IGNATIUS: Enduring art.

MICHAEL LYNTON: Yeah. The interview was not a great work of art. I’m not suggesting that.

ADI IGNATIUS: So one questions is, why do you want to, are you willing to talk about all this now?

MICHAEL LYNTON: I’m willing to talk about it for a number of reasons. First of all, because I don’t think people properly appreciate what it is that the folks at Sony Pictures went through and what a spectacular job they did in keeping the company going, and how they were very brave and very resourceful and resilient and got through it all. I don’t think people understand properly the level of destruction; the fact that, when you do get attacked like this, your entire business is in jeopardy. And I say that as a cautionary tale. I’m happy to talk about it because I think that all of the press that surrounded the stolen emails did a lot to obscure what was really at stake here, which was– as I mentioned a moment ago– the hack itself, and the destruction, and the resilience of the people who went through it.

And there’s also still controversy about whether or not we actually intended to release the movie. Which was never, ever in question. So I take every opportunity I can to remind people of that fact; that, you know, the minute it was evident we couldn’t put it out in theaters, we were trying very hard to find people who were willing to distribute it. And I think finally, I think it is a clear and present danger to businesses in America, and will be for some time going forward. And I think people need to be aware of it, because they need to take their own precautions. And there are other levels to it. I mean, I think we also have to work ourselves through what the relationship between government and private enterprise in all of this is. And that’s a debate that I think should go through.

ADI IGNATIUS: That was Michael Lynton, CEO of Sony Pictures Entertainment. For more of this interview, check out the July/August issue of Harvard Business Review, or go to HBR.org.